Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

AWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention

JSON — GET /api/aws-evidenceMD — /collect/config-data-backup-enabled.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementconfig-rulecontinuousAWS ConfigAmazon RDSAWS Backup

Fetch

$ aws configservice get-compliance-details-by-config-rule --config-rule-name db-instance-backup-enabled --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name backup-plan-min-frequency-and-min-retention-check --compliance-types NON_COMPLIANT
$ aws configservice describe-configuration-recorder-status
$ aws configservice describe-config-rule-evaluation-status --config-rule-names db-instance-backup-enabled
$ aws configservice describe-config-rule-evaluation-status --config-rule-names backup-plan-min-frequency-and-min-retention-check
$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text
$ aws organizations list-accounts --query 'Accounts[].Id' --output text

Expected output

Two EvaluationResults arrays; empty NON_COMPLIANT sets mean every RDS DB instance has automated backups within your backupRetentionMinimum and every AWS Backup plan meets requiredFrequencyValue/requiredRetentionDays. Managed rule identifiers: DB_INSTANCE_BACKUP_ENABLED, BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

Assertions — what makes it a pass

Assertions for AWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
db-instance-backup-enabled.EvaluationResultscount_eq 0Every RDS DB instance has automated backups meeting your retention minimum.every rowCP-09
backup-plan-min-frequency-and-min-retention-check.EvaluationResultscount_eq 0Every AWS Backup plan meets your required frequency and retention.every rowCP-09
configuration-recorder-status.ConfigurationRecordersStatus[].recordingeq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran.every rowCP-09
db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truedb-instance-backup-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowCP-09
db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsdb-instance-backup-enabled has a successful evaluation on record.every rowCP-09
backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truebackup-plan-min-frequency-and-min-retention-check has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowCP-09
backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsbackup-plan-min-frequency-and-min-retention-check has a successful evaluation on record.every rowCP-09

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-RPL-ABO
NIST 800-53 controls
recipe · 1 recipeCP-09
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:CP 3/35 →

GovCloud

AWS Config, RDS, and AWS Backup are available in AWS GovCloud (US); DB and backup-plan ARNs use partition arn:aws-us-gov

Notes & assertions

Set db-instance-backup-enabled's backupRetentionMinimum and backup-plan's requiredFrequencyValue/requiredFrequencyUnit/requiredRetentionDays to your CP-09 policy (defaults are 1/days and 35 days). These two cover RDS and AWS Backup-managed resources; for the other stores you run, add dynamodb-pitr-enabled, elasticache-redis-cluster-automatic-backup-check, and s3 versioning/replication as applicable. Backup existence is telemetry; the restore test that proves recoverability is CP-10's separate exercise — do not present a backup config as a successful restore. The frequency and retention that carry CP-09's organization-defined values live in the rule parameters, not in the output, so a human confirms they match the SSP; system documentation under CP-09(c) is never AWS telemetry.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Recovery Planning run (2)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under RPL, in the order the plan works them. The mark says how much of the evidence the command produces on its own.